Chat now with support
Chat with Support

Identity Manager 8.1.4 - Administration Guide for Connecting to SharePoint Online

Mapping a SharePoint Online environment in One Identity Manager Synchronizing a SharePoint Online environment Managing SharePoint Online user accounts and employees Managing the assignments of SharePoint Online groups and roles Mapping of SharePoint Online objects in One Identity Manager
SharePoint Online tenants SharePoint Online user accounts SharePoint Online groups SharePoint Online permission levels SharePoint Online site collections SharePoint Online sites SharePoint Online roles
Handling of SharePoint Online objects in the Web Portal Basic data for managing a SharePoint Online environment Configuration parameters for managing SharePoint Online Default project template for SharePoint Online Editing system objects About us

Synchronizing a SharePoint Online environment

One Identity Manager supports synchronization with SharePoint Online. One Identity Manager is responsible for synchronizing data between the SharePoint Online database and the One Identity Manager Service.

This sections explains how to:

  • Set up synchronization to import initial data from SharePoint Online tenant to the One Identity Manager database.

  • Adjust a synchronization configuration.

  • Start and deactivate the synchronization.

  • Analyze synchronization results.

TIP: Before you set up synchronization with a SharePoint Online tenant, familiarize yourself with the Synchronization Editor. For more information about this tool, see the One Identity Manager Target System Synchronization Reference Guide.

Detailed information about this topic

Setting up the initial synchronization

The Synchronization Editor provides a project template that can be used to set up the synchronization of user accounts and permissions for the SharePoint Online environment. You use these project templates to create synchronization projects with which you import the data from a SharePoint Online tenant into your One Identity Manager database. In addition, the required processes are created that are used for the provisioning of changes to target system objects from the One Identity Manager database into the target system.

To load SharePoint Online objects into the One Identity Manager database for the first time

  1. Prepare a user account in the Azure Active Directory tenant with sufficient permissions for synchronization. The Azure Active Directory tenant must be known in the One Identity Manager system.

  2. The One Identity Manager components for managing SharePoint Online systems are available if the TargetSystem | SharePointOnline configuration parameter is set.

    • In the Designer, check if the configuration parameter is set. Otherwise, set the configuration parameter and compile the database.

    • Other configuration parameters are installed when the module is installed. Check the configuration parameters and modify them as necessary to suit your requirements.

  3. Install and configure a synchronization server and declare the server as a Job server in One Identity Manager.
  4. Create a synchronization project with the Synchronization Editor.
Detailed information about this topic

Users and permissions for synchronizing with SharePoint Online

The following users are involved in synchronizing One Identity Manager with SharePoint Online.

Table 2: Users for synchronization
User Permissions
User for accessing SharePoint Online

For full synchronization of SharePoint Online tenant objects with the supplied One Identity Manager default configuration, you must provide a user account with the minimum required permissions. The following is required:

  • An administrative user account of the corresponding Azure Active Directory tenant, which has the following administration roles.

    • SharePoint administrators

    • Azure Active Directory company administrator/global administrator

    NOTE: This user account must be entered as the site collection administrator in all the site collections to be managed. You do this in SharePoint Online.

    For more detailed information about site collection administrators, see the Microsoft documentation.

One Identity Manager Service user account

The user account for One Identity Manager Service requires permissions to carry out operations at file level. For example, assigning permissions and creating and editing directories and files.

The user account must belong to the Domain users group.

The user account must have the Login as a service extended user permissions.

The user account requires access permissions to the internal web service.

NOTE: If One Identity Manager Service runs under the network service (NT Authority\NetworkService), you can issue access permissions for the internal web service with the following command line call:

netsh http add urlacl url=http://<IP address>:<port number>/ user="NT AUTHORITY\NETWORKSERVICE"

The user account needs full access to the One Identity Manager Service installation directory in order to automatically update One Identity Manager.

In the default installation, One Identity Manager is installed under:

  • %ProgramFiles(x86)%\One Identity (on 32-bit operating systems)
  • %ProgramFiles%\One Identity (on 64-bit operating systems)
User for accessing the One Identity Manager database

The Synchronization default system user is provided to execute synchronization with an application server.

Setting up the SharePoint Online synchronization server

All One Identity Manager Service actions are executed against the target system environment on the synchronization server. Data entries required for synchronization and administration with the One Identity Manager database are processed by the synchronization server.

The One Identity Manager Service with the SharePoint Online connector must be installed on the synchronization server.

Detailed information about this topic
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating